LOLDrivers high experimental sigma

Driver Load - POORTRY1.sys

Detects loading of driver POORTRY1.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=acac842a46f3501fe407b1db1b247a0b",
      "SHA1=31fac347aa26e92db4d8c9e1ba37a7c7a2234f08",
      "SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316",
      "IMPHASH=3fd33d5b3b52e2db91983ac4b1d7a3c4"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...